possible ddos on my site help - GoFuckYourself.com

esham · 04-10-2017, 12:57 PM

I use cloudflare on high Security Level. I noticed this in my errorlogs. Someone requests a txt file that isnt there. THeres different names being requested.

[Mon Apr 10 11:46:05.725813 2017] [access_compat

] [pid 1004058:tid 140249621440256] [client 108.162.229.118:18454] AH01797: client denied by server configuration: /home/vweb/domains/url.com/public_html/dsffds.txt, referer: url.com/dsffds.txt

My host said the ip was cloudflare. And suggested to upgrade off shared hosting. but I was runing fine before. Does any one have suggestions on what to do. Or how to grab the ip. I cant find anything in google analitics. Also if i switch back off cloudflare. It might just be temporary and they could just switch ips if I'm able to block it.

freecartoonporn · 04-10-2017, 08:38 PM

check cloudflare analytics >> Threats

what do you see ?

check this out , its pay as you go feature
https://www.cloudflare.com/rate-limiting/

you can rate limit in your webserver configs as well.

JuicyBunny · 04-10-2017, 08:40 PM

Brute forces are in overdrive right now. You should be able to rate limit or block them.

Nitzer Ebb · 04-10-2017, 08:45 PM

If it was DDOS you would know

Share hosting 2x

esham · 04-10-2017, 11:31 PM

Thanks that look promising i'll read up on it more. Id rather give cloudflare money then my host. My host needs to be ditched i know theres better out there. If im going to buy a dedicated server i think i dont want it with them.

60- 80 bad browsers a day. I don't think its a ddos but just seeing the error in log files for txt files seems suspicious. You have reached entry processes (EP) seems to happen around the same time each day. It could also be just growing site needing a upgrade. But im wanting to see if this is the issue first.

Quote:

Originally Posted by freecartoonporn

check cloudflare analytics >> Threats

what do you see ?

check this out , its pay as you go feature
https://www.cloudflare.com/rate-limiting/

you can rate limit in your webserver configs as well.

rowan · 04-11-2017, 01:08 AM

A real DDoS would be more like 80 bad browsers per second. It's probably just an automated probe.

Putting Cloudflare in front of your site complicates things because every access comes from the same IP.

freecartoonporn · 04-11-2017, 03:05 AM

Quote:

Originally Posted by esham

Thanks that look promising i'll read up on it more. Id rather give cloudflare money then my host. My host needs to be ditched i know theres better out there. If im going to buy a dedicated server i think i dont want it with them.

60- 80 bad browsers a day. I don't think its a ddos but just seeing the error in log files for txt files seems suspicious. You have reached entry processes (EP) seems to happen around the same time each day. It could also be just growing site needing a upgrade. But im wanting to see if this is the issue first.

60- 80 bad browsers a day is nothing.

something is wrong with your host, what is it ? a vps or shared hosting ?

digital ocean's $5 bucks vps is capable of much more.

try some ssd vps.

04-10-2017, 12:57 PM	#1
esham Confirmed User Join Date: Mar 2004 Posts: 614	possible ddos on my site help I use cloudflare on high Security Level. I noticed this in my errorlogs. Someone requests a txt file that isnt there. THeres different names being requested. [Mon Apr 10 11:46:05.725813 2017] [access_compat] [pid 1004058:tid 140249621440256] [client 108.162.229.118:18454] AH01797: client denied by server configuration: /home/vweb/domains/url.com/public_html/dsffds.txt, referer: url.com/dsffds.txt My host said the ip was cloudflare. And suggested to upgrade off shared hosting. but I was runing fine before. Does any one have suggestions on what to do. Or how to grab the ip. I cant find anything in google analitics. Also if i switch back off cloudflare. It might just be temporary and they could just switch ips if I'm able to block it. __________________ Double Your profit From Ad Brokers

04-10-2017, 08:38 PM	#2
freecartoonporn Confirmed User Industry Role: Join Date: Jan 2012 Location: NC Posts: 7,681	check cloudflare analytics >> Threats what do you see ? check this out , its pay as you go feature https://www.cloudflare.com/rate-limiting/ you can rate limit in your webserver configs as well. __________________ SSD Cloud Server, VPS Server, Simple Cloud Hosting \| DigitalOcean

04-10-2017, 08:45 PM	#4
Nitzer Ebb Confirmed User Industry Role: Join Date: Apr 2015 Location: Stjørdal, Norge Posts: 778	If it was DDOS you would know Share hosting 2x __________________ -= Krampus Productions =-

04-10-2017, 08:40 PM	#3
JuicyBunny So Fucking Banned Industry Role: Join Date: Jun 2010 Location: Tokyo Red Light District Posts: 2,145	Brute forces are in overdrive right now. You should be able to rate limit or block them.

04-11-2017, 01:08 AM	#6
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,373	A real DDoS would be more like 80 bad browsers per second. It's probably just an automated probe. Putting Cloudflare in front of your site complicates things because every access comes from the same IP.